Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
27-03-2023 05:29
Static task
static1
Behavioral task
behavioral1
Sample
ungziped_file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ungziped_file.exe
Resource
win10v2004-20230220-en
General
-
Target
ungziped_file.exe
-
Size
254KB
-
MD5
8d93c0e9645dd3bddfb8f658c51dc1b3
-
SHA1
5f2744ef4f6f2930bc320382df3d23d06e7ae9d1
-
SHA256
cb6260c92a905ed173ed763ba1d6a02cce82dc0f3895e58e0a2c68b59572e078
-
SHA512
682048622a97cd14898340c71c10795f1547b2a1c6b56a5add7e9582e5b6b66637da58a273ead3567bae8bc63d4875d4be5f516e4c7901dacaf81e52de4b4149
-
SSDEEP
3072:f66ea8jXuZ6bgAbd2wVH3R8LmzvzzfYuIWYCyXdgCLdCRaOVvVGb31fT0d5Ys:fKg6bgAEoB8LmznfYhWY0+JOm108
Malware Config
Extracted
warzonerat
91.193.75.142:5234
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/920-58-0x00000000001D0000-0x000000000032C000-memory.dmp warzonerat behavioral1/memory/920-59-0x00000000001D0000-0x000000000032C000-memory.dmp warzonerat behavioral1/memory/920-60-0x00000000001D0000-0x000000000032C000-memory.dmp warzonerat behavioral1/memory/920-64-0x00000000001D0000-0x000000000032C000-memory.dmp warzonerat behavioral1/memory/920-61-0x00000000001D0000-0x000000000032C000-memory.dmp warzonerat behavioral1/memory/920-69-0x00000000001D0000-0x000000000032C000-memory.dmp warzonerat behavioral1/memory/920-74-0x00000000001D0000-0x000000000032C000-memory.dmp warzonerat behavioral1/memory/1888-94-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral1/memory/1888-95-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat -
Executes dropped EXE 2 IoCs
Processes:
images.exeimages.exepid process 520 images.exe 1888 images.exe -
Loads dropped DLL 2 IoCs
Processes:
ungziped_file.exeimages.exepid process 920 ungziped_file.exe 520 images.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ungziped_file.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\Users\\Admin\\Documents\\images.exe" ungziped_file.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ungziped_file.exeimages.exedescription pid process target process PID 1596 set thread context of 920 1596 ungziped_file.exe ungziped_file.exe PID 520 set thread context of 1888 520 images.exe images.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
ungziped_file.exeungziped_file.exeimages.exeimages.exedescription pid process target process PID 1596 wrote to memory of 920 1596 ungziped_file.exe ungziped_file.exe PID 1596 wrote to memory of 920 1596 ungziped_file.exe ungziped_file.exe PID 1596 wrote to memory of 920 1596 ungziped_file.exe ungziped_file.exe PID 1596 wrote to memory of 920 1596 ungziped_file.exe ungziped_file.exe PID 1596 wrote to memory of 920 1596 ungziped_file.exe ungziped_file.exe PID 1596 wrote to memory of 920 1596 ungziped_file.exe ungziped_file.exe PID 1596 wrote to memory of 920 1596 ungziped_file.exe ungziped_file.exe PID 1596 wrote to memory of 920 1596 ungziped_file.exe ungziped_file.exe PID 1596 wrote to memory of 920 1596 ungziped_file.exe ungziped_file.exe PID 1596 wrote to memory of 920 1596 ungziped_file.exe ungziped_file.exe PID 1596 wrote to memory of 920 1596 ungziped_file.exe ungziped_file.exe PID 1596 wrote to memory of 920 1596 ungziped_file.exe ungziped_file.exe PID 1596 wrote to memory of 920 1596 ungziped_file.exe ungziped_file.exe PID 1596 wrote to memory of 920 1596 ungziped_file.exe ungziped_file.exe PID 1596 wrote to memory of 920 1596 ungziped_file.exe ungziped_file.exe PID 920 wrote to memory of 520 920 ungziped_file.exe images.exe PID 920 wrote to memory of 520 920 ungziped_file.exe images.exe PID 920 wrote to memory of 520 920 ungziped_file.exe images.exe PID 920 wrote to memory of 520 920 ungziped_file.exe images.exe PID 920 wrote to memory of 520 920 ungziped_file.exe images.exe PID 920 wrote to memory of 520 920 ungziped_file.exe images.exe PID 920 wrote to memory of 520 920 ungziped_file.exe images.exe PID 520 wrote to memory of 1888 520 images.exe images.exe PID 520 wrote to memory of 1888 520 images.exe images.exe PID 520 wrote to memory of 1888 520 images.exe images.exe PID 520 wrote to memory of 1888 520 images.exe images.exe PID 520 wrote to memory of 1888 520 images.exe images.exe PID 520 wrote to memory of 1888 520 images.exe images.exe PID 520 wrote to memory of 1888 520 images.exe images.exe PID 520 wrote to memory of 1888 520 images.exe images.exe PID 520 wrote to memory of 1888 520 images.exe images.exe PID 520 wrote to memory of 1888 520 images.exe images.exe PID 520 wrote to memory of 1888 520 images.exe images.exe PID 520 wrote to memory of 1888 520 images.exe images.exe PID 520 wrote to memory of 1888 520 images.exe images.exe PID 520 wrote to memory of 1888 520 images.exe images.exe PID 520 wrote to memory of 1888 520 images.exe images.exe PID 1888 wrote to memory of 1544 1888 images.exe cmd.exe PID 1888 wrote to memory of 1544 1888 images.exe cmd.exe PID 1888 wrote to memory of 1544 1888 images.exe cmd.exe PID 1888 wrote to memory of 1544 1888 images.exe cmd.exe PID 1888 wrote to memory of 1544 1888 images.exe cmd.exe PID 1888 wrote to memory of 1544 1888 images.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ungziped_file.exe"C:\Users\Admin\AppData\Local\Temp\ungziped_file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ungziped_file.exe"C:\Users\Admin\AppData\Local\Temp\ungziped_file.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\images.exe"C:\Users\Admin\Documents\images.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\images.exe"C:\Users\Admin\Documents\images.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\images.exeFilesize
254KB
MD58d93c0e9645dd3bddfb8f658c51dc1b3
SHA15f2744ef4f6f2930bc320382df3d23d06e7ae9d1
SHA256cb6260c92a905ed173ed763ba1d6a02cce82dc0f3895e58e0a2c68b59572e078
SHA512682048622a97cd14898340c71c10795f1547b2a1c6b56a5add7e9582e5b6b66637da58a273ead3567bae8bc63d4875d4be5f516e4c7901dacaf81e52de4b4149
-
C:\Users\Admin\Documents\images.exeFilesize
254KB
MD58d93c0e9645dd3bddfb8f658c51dc1b3
SHA15f2744ef4f6f2930bc320382df3d23d06e7ae9d1
SHA256cb6260c92a905ed173ed763ba1d6a02cce82dc0f3895e58e0a2c68b59572e078
SHA512682048622a97cd14898340c71c10795f1547b2a1c6b56a5add7e9582e5b6b66637da58a273ead3567bae8bc63d4875d4be5f516e4c7901dacaf81e52de4b4149
-
C:\Users\Admin\Documents\images.exeFilesize
254KB
MD58d93c0e9645dd3bddfb8f658c51dc1b3
SHA15f2744ef4f6f2930bc320382df3d23d06e7ae9d1
SHA256cb6260c92a905ed173ed763ba1d6a02cce82dc0f3895e58e0a2c68b59572e078
SHA512682048622a97cd14898340c71c10795f1547b2a1c6b56a5add7e9582e5b6b66637da58a273ead3567bae8bc63d4875d4be5f516e4c7901dacaf81e52de4b4149
-
\Users\Admin\Documents\images.exeFilesize
254KB
MD58d93c0e9645dd3bddfb8f658c51dc1b3
SHA15f2744ef4f6f2930bc320382df3d23d06e7ae9d1
SHA256cb6260c92a905ed173ed763ba1d6a02cce82dc0f3895e58e0a2c68b59572e078
SHA512682048622a97cd14898340c71c10795f1547b2a1c6b56a5add7e9582e5b6b66637da58a273ead3567bae8bc63d4875d4be5f516e4c7901dacaf81e52de4b4149
-
\Users\Admin\Documents\images.exeFilesize
254KB
MD58d93c0e9645dd3bddfb8f658c51dc1b3
SHA15f2744ef4f6f2930bc320382df3d23d06e7ae9d1
SHA256cb6260c92a905ed173ed763ba1d6a02cce82dc0f3895e58e0a2c68b59572e078
SHA512682048622a97cd14898340c71c10795f1547b2a1c6b56a5add7e9582e5b6b66637da58a273ead3567bae8bc63d4875d4be5f516e4c7901dacaf81e52de4b4149
-
memory/520-81-0x0000000000BF0000-0x0000000000C34000-memory.dmpFilesize
272KB
-
memory/920-59-0x00000000001D0000-0x000000000032C000-memory.dmpFilesize
1.4MB
-
memory/920-57-0x00000000001D0000-0x000000000032C000-memory.dmpFilesize
1.4MB
-
memory/920-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/920-61-0x00000000001D0000-0x000000000032C000-memory.dmpFilesize
1.4MB
-
memory/920-69-0x00000000001D0000-0x000000000032C000-memory.dmpFilesize
1.4MB
-
memory/920-74-0x00000000001D0000-0x000000000032C000-memory.dmpFilesize
1.4MB
-
memory/920-60-0x00000000001D0000-0x000000000032C000-memory.dmpFilesize
1.4MB
-
memory/920-55-0x00000000001D0000-0x000000000032C000-memory.dmpFilesize
1.4MB
-
memory/920-58-0x00000000001D0000-0x000000000032C000-memory.dmpFilesize
1.4MB
-
memory/920-64-0x00000000001D0000-0x000000000032C000-memory.dmpFilesize
1.4MB
-
memory/920-56-0x00000000001D0000-0x000000000032C000-memory.dmpFilesize
1.4MB
-
memory/1544-97-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/1544-96-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/1596-54-0x00000000009E0000-0x0000000000A24000-memory.dmpFilesize
272KB
-
memory/1888-90-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1888-94-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/1888-95-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB